scientific-computing-system 2.2.14__tar.gz → 2.2.15__tar.gz

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.15}/.github/workflows/bot-reviewer.yml

@@ -9,7 +9,6 @@ env:
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   approve:

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.15}/.github/workflows/changelog.yml

@@ -29,8 +29,7 @@ on:
         type: string
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 # Serialize dispatches: two concurrent runs would both regenerate CHANGELOG.md
 # and force-push the single shared branch, racing each other. The fixed

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.15}/.github/workflows/codeql.yml

@@ -26,13 +26,15 @@ concurrency:
 
 permissions:
   contents: read
-  security-events: write
 
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      contents: read
+      security-events: write
     strategy:
       fail-fast: false
       matrix:

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.15}/.github/workflows/dependency-review.yml

@@ -6,11 +6,13 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   dependency-review:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.15}/.github/workflows/npm-publish.yml

@@ -99,18 +99,29 @@ jobs:
       actions: read
     outputs:
       published: ${{ steps.check.outputs.published }}
+      head_sha: ${{ steps.check.outputs.head_sha }}
     steps:
       - name: Check the triggering Release run published
         id: check
+        shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
           RUN_ID: ${{ github.event.workflow_run.id }}
         run: |
           set -euo pipefail
-          conclusion="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}/jobs?per_page=100" \
+          data="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}" \
+            --jq '[.head_sha, .event, .head_branch, .conclusion, .repository.full_name] | @tsv')"
+          IFS=$'\t' read -r sha event branch conclusion repo <<<"${data}"
+          echo "head_sha=${sha}" >> "$GITHUB_OUTPUT"
+          if [ "${event}" != "push" ] || [ "${branch}" != "main" ] || \
+             [ "${conclusion}" != "success" ] || [ "${repo}" != "${GITHUB_REPOSITORY}" ]; then
+            echo "::error::Run ${RUN_ID} is not a successful push on ${GITHUB_REPOSITORY} main."
+            exit 1
+          fi
+          publish_conclusion="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}/jobs?per_page=100" \
             --jq '[.jobs[] | select(.name == "Build + verify + publish to PyPI + metadata-only GitHub Release") | .conclusion] | first // "missing"')"
-          echo "Release publish job: ${conclusion}"
-          if [ "${conclusion}" = "success" ]; then
+          echo "Release publish job: ${publish_conclusion}"
+          if [ "${publish_conclusion}" = "success" ]; then
             echo "published=true" >> "$GITHUB_OUTPUT"
           else
             echo "published=false" >> "$GITHUB_OUTPUT"
@@ -140,7 +151,7 @@ jobs:
           persist-credentials: false
           # Release-triggered runs must publish the exact commit that was released,
           # not whatever main points at when the follow-up workflow starts.
-          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.ref }}
+          ref: ${{ github.event_name == 'workflow_run' && needs.release_gate.outputs.head_sha || github.ref }}
 
       # GATE: bind each trigger to the version it is allowed to publish.
       #

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.15}/.github/workflows/pypi-release-policy.yml

@@ -37,11 +37,35 @@ jobs:
     timeout-minutes: 15
     permissions:
       contents: write
+      actions: read
     steps:
+      - name: Resolve the source commit
+        id: target
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          EVENT_NAME: ${{ github.event_name }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+        run: |
+          set -euo pipefail
+          if [ "${EVENT_NAME}" = "workflow_run" ]; then
+            data="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}" \
+              --jq '[.head_sha, .event, .head_branch, .conclusion, .repository.full_name] | @tsv')"
+            IFS=$'\t' read -r sha event branch conclusion repo <<<"${data}"
+            if [ "${event}" != "push" ] || [ "${branch}" != "main" ] || \
+               [ "${conclusion}" != "success" ] || [ "${repo}" != "${GITHUB_REPOSITORY}" ]; then
+              echo "::error::Run ${RUN_ID} is not a successful push on ${GITHUB_REPOSITORY} main."
+              exit 1
+            fi
+          else
+            sha="${GITHUB_SHA}"
+          fi
+          echo "sha=${sha}" >> "$GITHUB_OUTPUT"
+
       - name: Check out released source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
+          ref: ${{ steps.target.outputs.sha }}
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.15}/.github/workflows/release.yml

@@ -50,13 +50,32 @@ jobs:
     timeout-minutes: 15
     permissions:
       contents: read
+      actions: read
     outputs:
       release_sha: ${{ steps.candidate.outputs.release_sha }}
       should_release: ${{ steps.candidate.outputs.should_release }}
     steps:
+      - name: Resolve and verify the triggering CI run
+        id: target
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+        run: |
+          set -euo pipefail
+          data="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}" \
+            --jq '[.head_sha, .event, .head_branch, .conclusion, .repository.full_name] | @tsv')"
+          IFS=$'\t' read -r sha event branch conclusion repo <<<"${data}"
+          if [ "${event}" != "push" ] || [ "${branch}" != "main" ] || \
+             [ "${conclusion}" != "success" ] || [ "${repo}" != "${GITHUB_REPOSITORY}" ]; then
+            echo "::error::Run ${RUN_ID} is not a successful push on ${GITHUB_REPOSITORY} main."
+            exit 1
+          fi
+          echo "sha=${sha}" >> "$GITHUB_OUTPUT"
+
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event.workflow_run.head_sha }}
+          ref: ${{ steps.target.outputs.sha }}
           fetch-depth: 2
 
       - name: Bind release to the exact CI-tested commit

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.15}/CHANGELOG.md

@@ -19,6 +19,13 @@ a git tag in this repository or on `origin` (checked with `git ls-remote --tags`
 Any retroactive `v2.2.6` or `v2.2.7` tag should point at those commits. This note records
 what the history supports; it does not claim that a tag exists.
 
+## [v2.2.15] - 2026-10-23
+
+### Dependency security floors
+
+- Raise the test and documentation dependency floors to versions that carry security fixes: `pytest>=9.0.3` (PYSEC-2026-1845) and `mkdocs-material>=9.7.7` (PYSEC-2026-3864). The locked development environment already resolved these versions; the manifests now state the same minimum.
+- Bump synchronized package metadata to 2.2.15 as required by the version-discipline gate for the `[project]` dependency change.
+
 ## [v2.2.14] - 2026-10-23
 
 ### Input validation and supply-chain transparency

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.15}/CITATION.cff

@@ -5,7 +5,7 @@ title: "scientific-computing-system"
 # Keep `version` in lockstep with pyproject.toml [project].version and
 # src/cds/_version.py. scripts/check_version_discipline.py and
 # scripts/check_version_lockstep.py enforce this.
-version: 2.2.14
+version: 2.2.15
 authors:
   - name: "Furox-Art"
     email: "furkanarkn1451@gmail.com"
@@ -50,5 +50,5 @@ preferred-citation:
   authors:
     - name: "Furox-Art"
   year: 2026
-  version: 2.2.14
+  version: 2.2.15
   url: "https://github.com/Furox-Art/scientific-computing-system"

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.15}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: scientific-computing-system
-Version: 2.2.14
+Version: 2.2.15
 Summary: A pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, scientific workflows, dimensional analysis, and optional research-data backends. Zero runtime dependencies.
 Project-URL: Homepage, https://github.com/Furox-Art/scientific-computing-system
 Project-URL: Repository, https://github.com/Furox-Art/scientific-computing-system
@@ -34,7 +34,7 @@ Requires-Dist: h5py>=3.10; extra == 'all'
 Requires-Dist: hypothesis>=6.100; extra == 'all'
 Requires-Dist: ipykernel; extra == 'all'
 Requires-Dist: matplotlib>=3.8.0; extra == 'all'
-Requires-Dist: mkdocs-material>=9.0.0; extra == 'all'
+Requires-Dist: mkdocs-material>=9.7.7; extra == 'all'
 Requires-Dist: mkdocs>=1.5.0; extra == 'all'
 Requires-Dist: mkdocstrings[python]>=0.24.0; extra == 'all'
 Requires-Dist: mypy>=1.10; extra == 'all'
@@ -44,7 +44,7 @@ Requires-Dist: numpy>=1.26; extra == 'all'
 Requires-Dist: pandas>=2.0; extra == 'all'
 Requires-Dist: pre-commit; extra == 'all'
 Requires-Dist: pytest-cov; extra == 'all'
-Requires-Dist: pytest>=8.0; extra == 'all'
+Requires-Dist: pytest>=9.0.3; extra == 'all'
 Requires-Dist: ruff==0.15.17; extra == 'all'
 Requires-Dist: scikit-learn>=1.4; extra == 'all'
 Requires-Dist: scipy>=1.11; extra == 'all'
@@ -65,7 +65,7 @@ Requires-Dist: pandas-stubs>=2.0; extra == 'dev'
 Requires-Dist: pre-commit; extra == 'dev'
 Requires-Dist: ruff==0.15.17; extra == 'dev'
 Provides-Extra: docs
-Requires-Dist: mkdocs-material>=9.0.0; extra == 'docs'
+Requires-Dist: mkdocs-material>=9.7.7; extra == 'docs'
 Requires-Dist: mkdocs>=1.5.0; extra == 'docs'
 Requires-Dist: mkdocstrings[python]>=0.24.0; extra == 'docs'
 Provides-Extra: io
@@ -91,7 +91,7 @@ Requires-Dist: sympy>=1.12; extra == 'scientific'
 Requires-Dist: z3-solver>=4.12.2; extra == 'scientific'
 Provides-Extra: test
 Requires-Dist: pytest-cov; extra == 'test'
-Requires-Dist: pytest>=8.0; extra == 'test'
+Requires-Dist: pytest>=9.0.3; extra == 'test'
 Description-Content-Type: text/markdown
 
 <p align="center">
@@ -277,7 +277,7 @@ The package installs a `cds` command with 13 subcommands:
 
 ```console
 $ cds --version
-System version 2.2.14
+System version 2.2.15
 $ cds constants        # physical constants table
 ```
 

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.15}/README.md

@@ -181,7 +181,7 @@ The package installs a `cds` command with 13 subcommands:
 
 ```console
 $ cds --version
-System version 2.2.14
+System version 2.2.15
 $ cds constants        # physical constants table
 ```
 

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.15}/codemeta.json

@@ -2,7 +2,7 @@
   "@context": "https://doi.org/10.5063/schema/codemeta-2.0",
   "@type": "SoftwareSourceCode",
   "name": "scientific-computing-system",
-  "version": "2.2.14",
+  "version": "2.2.15",
   "description": "Pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, and scientific workflows. Zero runtime dependencies. This is the front door; scientific-computing-system-2.0 is the NumPy build of the same work.",
   "license": "https://spdx.org/licenses/MIT",
   "codeRepository": "https://github.com/Furox-Art/scientific-computing-system",

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.15}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scientific-computing-system",
-  "version": "2.2.14",
+  "version": "2.2.15",
   "description": "Scientific Computing System launcher - a thin Node wrapper that forwards to the pure-Python `cds` CLI. This npm package ships NO Python code: it requires the Python distribution to be installed (`pip install scientific-computing-system`), otherwise `scs` exits non-zero with an actionable message.",
   "main": "index.js",
   "bin": {

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.15}/pyproject.toml

@@ -2,7 +2,7 @@
 # Distribution name. Formerly published as "cognitive-discovery-system";
 # the import name stays `cds`. Keep the old PyPI project alive as an alias.
 name = "scientific-computing-system"
-version = "2.2.14"
+version = "2.2.15"
 description = "A pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, scientific workflows, dimensional analysis, and optional research-data backends. Zero runtime dependencies."
 readme = "README.md"
 license = "MIT"
@@ -38,7 +38,7 @@ dependencies = []
 all = [
     "streamlit>=1.30.0",
     "matplotlib>=3.8.0",
-    "pytest>=8.0",
+    "pytest>=9.0.3",
     "pytest-cov",
     "ruff==0.15.17",
     "mypy>=1.10",
@@ -47,7 +47,7 @@ all = [
     "ipykernel",
     "notebook",
     "mkdocs>=1.5.0",
-    "mkdocs-material>=9.0.0",
+    "mkdocs-material>=9.7.7",
     "mkdocstrings[python]>=0.24.0",
     "hypothesis>=6.100",
     "pandas>=2.0",
@@ -93,7 +93,7 @@ plot = [
     "matplotlib>=3.8.0",
 ]
 test = [
-    "pytest>=8.0",
+    "pytest>=9.0.3",
     "pytest-cov",
 ]
 # Property-based testing. Used only by tests/test_property_invariants.py and
@@ -127,7 +127,7 @@ dev = [
 ]
 docs = [
     "mkdocs>=1.5.0",
-    "mkdocs-material>=9.0.0",
+    "mkdocs-material>=9.7.7",
     "mkdocstrings[python]>=0.24.0",
 ]
 # Promo/asset build tooling. Used only by scripts/build_gif.py,

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.15}/src/cds/_version.py

@@ -5,5 +5,5 @@ from __future__ import annotations
 
 __all__ = ["__version__", "version", "__version_tuple__", "version_tuple"]
 
-__version__ = version = "2.2.14"
+__version__ = version = "2.2.15"
 __version_tuple__ = version_tuple = (2, 2, 14)